Financial firms would share requested account data without access fees

Covered financial firms would provide requested data electronically and maintain a connection for outside software, without charging for requests, access, or that connection. The rules cover New York residents and small businesses dealing with covered banks, financial asset custodians, and other state-regulated data providers. Covered data includes at least 24 months of transactions, balances, and other specified account information. Excluded information includes confidential business information, legally protected information, records collected solely to prevent fraud or money laundering, and data the firm cannot normally retrieve. Firms could deny an outside representative access to meet specific financial safety obligations or applicable law. Safety criteria would have to be standardized and available on request. Firms would have to justify such denials with a specific, known risk likely to cause substantial harm and treat representatives facing similar risks consistently. Firms would have to give prompt notice of denied access and could not impose unreasonable delays, barriers, or discriminatory restrictions. These requirements would take effect 60 days after the bill becomes law.

Outside people and organizations would need express, informed permission before requesting account data for a customer. These duties cover outside people or organizations accessing a consumer's or small business's data with permission. Customers would need a simple, clear way to view their data-sharing permissions and withdraw them at any time. Outside services would have to limit data collection, use, and storage to what is reasonably needed for the requested product or service. Outside services would have to follow applicable federal information security rules or the Federal Trade Commission's customer information safeguards. Financial firms would have to verify requests using at least the same processes and information they use for online banking. These requirements would take effect 60 days after the bill becomes law.

New York's superintendent of financial services would enforce these rules. Covered financial firms found to violate the rules could face a civil fine of up to $10,000 for each violation. Violations could include charging prohibited access fees or imposing prohibited restrictions on data access. These enforcement provisions would take effect 60 days after the bill becomes law.